decaf-project / DECAF

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Where does the parameter proc_exec_connector in procinfo.ini file come from?

newthis opened this issue · comments

I compiled the procinfo.c into the linux kernel, and the dmesg log is below, no proc_exec_connector parameter is found.
So I want to ask how can I figure out this value.

[ 0.220574] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.221914] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.222650] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 0.227781] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[ 0.228425] io scheduler noop registered
[ 0.228680] io scheduler cfq registered (default)
[ 0.229279] strName = 4.1.17
[ 0.229279] init_task_addr = 3227491000
[ 0.229279] init_task_size = 872
[ 0.229279] ts_tasks = 292
[ 0.229279] ts_pid = 400
[ 0.229279] ts_tgid = 404
[ 0.229279] ts_group_leader = 432
[ 0.229279] ts_thread_group = 488
[ 0.229279] ts_real_parent = 408
[ 0.229279] ts_mm = 300
[ 0.229279] ts_stack = 4
[ 0.230525] module_name = 12
[ 0.230525] module_size = 208
[ 0.230525] module_init = 200
[ 0.230525] module_list = 4
[ 0.231035] ts_real_cred = 616
[ 0.231035] ts_cred = 620
[ 0.231035] ts_comm = 624
[ 0.231035] cred_uid = 4
[ 0.231035] cred_gid = 8
[ 0.231035] cred_euid = 20
[ 0.231035] cred_egid = 24
[ 0.231725] mm_mmap = 0
[ 0.231725] mm_pgd = 32
[ 0.231725] mm_arg_start = 136
[ 0.231725] mm_start_brk = 124
[ 0.231725] mm_brk = 128
[ 0.231725] mm_start_stack = 132
[ 0.232340] vma_vm_start = 0
[ 0.232340] vma_vm_end = 4
[ 0.232340] vma_vm_next = 8
[ 0.232340] vma_vm_file = 80
[ 0.232340] vma_vm_flags = 40
[ 0.232340] vma_vm_pgoff = 76
[ 0.233120] file_dentry = 12
[ 0.233120] file_inode = 40
[ 0.233120] dentry_d_name = 24
[ 0.233120] dentry_d_iname = 44
[ 0.233120] dentry_d_parent = 16
[ 0.233120] ti_task = 12
[ 0.233120] inode_ino = 28
[ 0.304148] vma_link = 3221761964
[ 0.304378] vma_adjust = 3221762088
[ 0.304517] remove_vma = 3221760012
[ 0.304670] modules = 3227509296
[ 0.304763] trim_init_extable = 3222849576

solved

Hi @newthis, can you explain how you solved it? My armel kernel image does not retrieve the proc_exec_connector parameter with some others. Thanks